MSSQL Server Failed Logon Attempt
Detects failed logon attempts to MSSQL server instances, which can indicate brute-force attacks, password guessing, or credential stuffing attempts against database accounts. This rule specifically looks for Event ID 18456 from MSSQL providers in the Windows Application event log.
Sigma
